Some approaches use a second neural network to classify adversarial and non-adversarial images [1]}.
However, Carlini and Wagner [2]} show that by extending the attack, this second neural network can be fooled as well. Recently, Tramèr et al. [3]} showed that many defenses are not robust against so-called adaptive attacks, which are aware of the underlying defense method.
